How to check the logs of registry change from event viewer

Question

How to check the logs of registry change from event viewer

Azure 0

I was unable to RDP to azure vm and getting RDP 3 line error

When I ran rdpsettings from Run command in azure portal found the registry value of "fdenytsconnections" as 1 and it needs to be 0. Changed value to 0 and able to RDP now.

I need to know who changed the registry value. When I googled it 4657 is the event id for registry modification. When I checked it in security logs, did not find any logs.

Please help me finding who made the change.

KarishmaTiwari-MSFT 14,092 Reputation points Microsoft Employee

2023-05-17T18:08:14.06+00:00

@Azure Thanks for posting your query on Microsoft Q&A.

I'm sorry to hear that you are facing this issue. Based on the information you provided, it seems that you are trying to find out who changed the registry value of "fdenytsconnections" from 0 to 1.

Can you please confirm if you were able to check the event logs by using the Windows Event Viewer? It can help with finding out who made the change to the registry value.

If you have already done that and are unable to find any logs related to the registry change, it is possible that the security logs have been cleared/overwritten or the auditing of registry changes was not enabled at the time of the modification. Therefore, it may not be possible to determine who made the change. In such cases, it is recommended to review the access controls on the affected registry key to prevent unauthorized changes in the future.

As you mentioned, event ID 4657 is the event ID for registry modification. To enable auditing of registry changes, you can follow the steps mentioned in this Microsoft article. Once auditing is enabled, you can check the security logs for event ID 4657 to determine who made the change.

I hope this helps. Let me know if you have any further questions.
KarishmaTiwari-MSFT 14,092 Reputation points Microsoft Employee

2023-05-23T00:07:28.99+00:00

@Azure Just checking in to see if the above comment helped. If you have any further query do let us know.

KarishmaTiwari-MSFT 14,092 Reputation points Microsoft Employee

2023-05-17T18:08:14.06+00:00

@Azure Thanks for posting your query on Microsoft Q&A.

I'm sorry to hear that you are facing this issue. Based on the information you provided, it seems that you are trying to find out who changed the registry value of "fdenytsconnections" from 0 to 1.

Can you please confirm if you were able to check the event logs by using the Windows Event Viewer? It can help with finding out who made the change to the registry value.

If you have already done that and are unable to find any logs related to the registry change, it is possible that the security logs have been cleared/overwritten or the auditing of registry changes was not enabled at the time of the modification. Therefore, it may not be possible to determine who made the change. In such cases, it is recommended to review the access controls on the affected registry key to prevent unauthorized changes in the future.

As you mentioned, event ID 4657 is the event ID for registry modification. To enable auditing of registry changes, you can follow the steps mentioned in this Microsoft article. Once auditing is enabled, you can check the security logs for event ID 4657 to determine who made the change.

I hope this helps. Let me know if you have any further questions.
KarishmaTiwari-MSFT 14,092 Reputation points Microsoft Employee

2023-05-23T00:07:28.99+00:00

@Azure Just checking in to see if the above comment helped. If you have any further query do let us know.

How to check the logs of registry change from event viewer

Activity